| शीर्षक | fuyang_lipengjun platform 1.0 broken function level authorization |
|---|
| विवरण | Product: platform
URL: http://host/adposition/queryAll
Title: Broken Function Level Authorization in AdPositionController's queryAll Method
PoC (Proof of Concept):
Log in to the application with any user account, including those with low privileges.
Send a GET request to the endpoint http://host/adposition/queryAll.
The server returns a complete list of ad position information. This data should typically be restricted to users with administrative privileges.
Effect: The queryAll method in the AdPositionController class lacks any permission checks. This allows any authenticated user, regardless of their assigned roles or permissions, to access the list of all ad position data, leading to unauthorized information disclosure. |
|---|
| स्रोत | ⚠️ https://www.cnblogs.com/aibot/p/19063427 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 30/08/2025 04:26 PM (1 वर्ष पहले) |
|---|
| संयम | 07/09/2025 08:43 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323042 [fuyang_lipengjun platform 1.0.0 AdPositionController /adposition/queryAll अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|